Check for null RenderWidgetHostDelegate before canceling scroll bubble

There were instances of crashes during destruction with nested
WebContents, if an inter-process scroll bubble was in progress. This
patch verifies that there the WebContents hasn't been disconnected
from its RenderWidgetHosts before attempting to cancel scroll
bubbling and dereferencing the RenderWidgetHostDelegate pointer.

BUG=644306
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_site_isolation

Review-Url: https://codereview.chromium.org/2319633002
Cr-Commit-Position: refs/heads/master@{#417054}

content/browser/frame_host/cross_process_frame_connector.cc

@@ -55,7 +55,13 @@ void CrossProcessFrameConnector::set_view(
     RenderWidgetHostViewChildFrame* view) {
   // Detach ourselves from the previous |view_|.
   if (view_) {
-    if (is_scroll_bubbling_ && GetParentRenderWidgetHostView()) {
+    // The RenderWidgetHostDelegate needs to be checked because set_view() can
+    // be called during nested WebContents destruction. See
+    // https://crbug.com/644306.
+    if (is_scroll_bubbling_ && GetParentRenderWidgetHostView() &&
+        RenderWidgetHostImpl::From(
+            GetParentRenderWidgetHostView()->GetRenderWidgetHost())
+            ->delegate()) {
       RenderWidgetHostImpl::From(
           GetParentRenderWidgetHostView()->GetRenderWidgetHost())
           ->delegate()